In them will demonstrate by several code examples, how JavaScript can be used for evil uses.

This started a while ago, when, while chatting with Giorgio Maone, and showing him an example that crashed Firefox (using intervals), he said as response.. "there's nothing we can do, javascript is just evil"..

The phrase "javascript is just evil" captivated me in such a way, that I started thinking in which ways javascript could be used for evil.

Now, I divided the document in 3 sections, and them divided into 5 chapters.

JavaScript is just evil (for your server).

JavaScript is just evil (for your local files).

2 comments:

Interesting research. Some would plain call it the 'AOP features' of JavaScript - others might see grave security problems in relation to XSS ;)

I once installed a client side security monitor for a client which extended common XSS probing methods like alert and document.write with a JSOD based logging hence all client side application logic used console.log|dir for debugging purposes.

What I didn't know was how to monitor the changes of variable values - very interesting stuff!